CV0-004 Security Practice Question
A cloud administrator is designing network security for a three-tier application. The web tier must be accessible from the internet, but the application and database tiers should only be reachable from the web tier. Which security group configuration should be used?
⚠ Common exam trap
A common trap is confusing the functionality of stateful security groups with stateless network ACLs. Candidates may choose network ACLs (Option D) thinking they provide similar control, not realizing that security groups support logical references to other security groups, which is essential for dynamic tier-to-tier access in a three-tier architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use separate security groups: web allows HTTP/HTTPS from 0.0.0.0/0; app allows traffic from web security group; db allows traffic from app security group
It uses separate security groups for each tier, implementing the principle of least privilege. The web tier security group allows HTTP/HTTPS from 0.0.0.0/0 for internet access, while the app tier security group references the web tier security group as its source, ensuring only traffic from the web tier can reach the application tier. Similarly, the database tier security group references the app tier security group, restricting access exclusively to the application tier. This configuration enforces strict east-west traffic control and prevents direct internet access to the internal tiers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use separate security groups: web allows HTTP/HTTPS from 0.0.0.0/0; app allows traffic from web security group; db allows traffic from app security group
Why this is correct
Security groups can reference other security groups as sources, providing fine-grained control.
- ✗
Assign the same security group to all tiers and use a single inbound rule
Why it's wrong here
Different tiers have different access requirements; separate security groups are needed.
- ✗
Place all tiers in the same subnet and use a network ACL to permit all traffic
Why it's wrong here
This would not provide proper segmentation and defeats the purpose of tier isolation.
- ✗
Configure a network ACL for each subnet with allow rules for the required traffic
Why it's wrong here
Network ACLs operate at the subnet level as stateless packet filters, so they cannot enforce traffic flows between specific tiers within the same subnet or restrict access based on instance-level identity. This fails the requirement that only the web tier’s instances, not the entire subnet, should reach the application and database tiers. The option is tempting because network ACLs are commonly used for subnet-level perimeter security, and they would be correct if the requirement were to allow or deny traffic to entire subnets rather than to specific compute instances.
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.